diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b4c0951..9268f0f 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -146,8 +146,24 @@ variables:
     - .test_ghcup_version
     - .darwin:aarch64
     - .root_cleanup
-  before_script:
-    - ./.gitlab/before_script/darwin/install_deps.sh
+  script: |
+    set -Eeuo pipefail
+    function runInNixShell() {
+      time nix-shell .gitlab/shell.nix \
+        -I nixpkgs=https://github.com/angerman/nixpkgs/archive/75f7281738b.tar.gz \
+        --argstr system "x86_64-darwin" \
+        --pure \
+        --keep GHC_VERSION --keep CABAL_INSTALL_VERSION --keep BUILD_FLAVOUR \
+        --keep BIN_DIST_PREP_TAR_COMP --keep CPUS --keep PROJECT_DIR \
+        --keep CI_PROJECT_DIR --keep MAKE_ARGS --keep HADRIAN_ARGS --keep CABAL_CACHE \
+        --keep LANG --keep CONFIGURE_ARGS --keep TEST_ENV --keep BIN_DIST_NAME \
+        --keep MACOSX_DEPLOYMENT_TARGET --keep ac_cv_func_clock_gettime --keep HACKAGE_INDEX_STATE \
+        --keep CABAL_DIR --keep ARCH --keep OS --keep CABAL_VERSION --keep GHC_VERSION \ 
+        --keep JSON_VERSION --ARTIFACT \
+        --run "$1" 2>&1
+    }
+    runInNixShell ./.gitlab/before_script/darwin/install_deps.sh 2>&1
+    runInNixShell ./.gitlab/script/ghcup_version.sh 2>&1
 
 .test_ghcup_version:freebsd:
   extends:
@@ -401,8 +417,24 @@ release:freebsd:
     - .freebsd
     - .release_ghcup
     - .root_cleanup
-  before_script:
-    - ./.gitlab/before_script/freebsd/install_deps.sh
+  script: |
+    set -Eeuo pipefail
+    function runInNixShell() {
+      time nix-shell .gitlab/shell.nix \
+        -I nixpkgs=https://github.com/angerman/nixpkgs/archive/75f7281738b.tar.gz \
+        --argstr system "x86_64-darwin" \
+        --pure \
+        --keep GHC_VERSION --keep CABAL_INSTALL_VERSION --keep BUILD_FLAVOUR \
+        --keep BIN_DIST_PREP_TAR_COMP --keep CPUS --keep PROJECT_DIR \
+        --keep CI_PROJECT_DIR --keep MAKE_ARGS --keep HADRIAN_ARGS --keep CABAL_CACHE \
+        --keep LANG --keep CONFIGURE_ARGS --keep TEST_ENV --keep BIN_DIST_NAME \
+        --keep MACOSX_DEPLOYMENT_TARGET --keep ac_cv_func_clock_gettime --keep HACKAGE_INDEX_STATE \
+        --keep CABAL_DIR --keep ARCH --keep OS --keep CABAL_VERSION --keep GHC_VERSION \ 
+        --keep JSON_VERSION --ARTIFACT \
+        --run "$1" 2>&1
+    }
+    runInNixShell ./.gitlab/before_script/freebsd/install_deps.sh 2>&1
+    runInNixShell ./.gitlab/script/ghcup_release.sh 2>&1
   variables:
     ARTIFACT: "x86_64-portbld-freebsd-ghcup"
     GHC_VERSION: "8.10.5"
diff --git a/.gitlab/before_script/darwin/install_deps.sh b/.gitlab/before_script/darwin/install_deps.sh
index 4cc3b85..fb8f49d 100755
--- a/.gitlab/before_script/darwin/install_deps.sh
+++ b/.gitlab/before_script/darwin/install_deps.sh
@@ -7,7 +7,6 @@ set -eux
 mkdir -p "${TMPDIR}"
 
 if [ $ARCH = 'ARM64' ] ; then
-	export PATH="/opt/homebrew/opt/llvm/bin:$PATH"
 	curl -sSfL https://downloads.haskell.org/~ghcup/0.1.15.1/aarch64-apple-darwin-ghcup-0.1.15.1 > ./ghcup-bin
 	chmod +x ghcup-bin
 else
diff --git a/.gitlab/script/ghcup_version.sh b/.gitlab/script/ghcup_version.sh
index 0412e2a..6c4cda1 100755
--- a/.gitlab/script/ghcup_version.sh
+++ b/.gitlab/script/ghcup_version.sh
@@ -76,8 +76,6 @@ else
 	rm -rf "${GHCUP_INSTALL_BASE_PREFIX}"/.ghcup
 fi
 
-which ghcup
-
 ### manual cli based testing
 
 
diff --git a/.gitlab/shell.nix b/.gitlab/shell.nix
new file mode 100644
index 0000000..5542260
--- /dev/null
+++ b/.gitlab/shell.nix
@@ -0,0 +1,91 @@
+{ system ? "aarch64-darwin"
+#, nixpkgs ? fetchTarball https://github.com/angerman/nixpkgs/archive/257cb120334.tar.gz #apple-silicon.tar.gz
+, pkgs ? import <nixpkgs> { inherit system; }
+, compiler ? if system == "aarch64-darwin" then "ghc8103Binary" else "ghc8103"
+}: pkgs.mkShell {
+  # this prevents nix from trying to write the env-vars file.
+  # we can't really, as NIX_BUILD_TOP/env-vars is not set.
+  noDumpEnvVars=1;
+
+  # stop polluting LDFLAGS with -liconv
+  dontAddExtraLibs = true;
+
+  # we need to inject ncurses into --with-curses-libraries.
+  # the real fix is to teach terminfo to use libcurses on macOS.
+  # CONFIGURE_ARGS = "--with-intree-gmp --with-curses-libraries=${pkgs.ncurses.out}/lib";
+  CONFIGURE_ARGS = "--with-intree-gmp --with-curses-libraries=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib --with-iconv-includes=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include --with-iconv-libraries=/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib SH=/bin/bash";
+
+  # magic speedup pony :facepalm:
+  #
+  # nix has the ugly habbit of duplicating ld flags more than necessary.  This
+  # somewhat consolidates this.
+  shellHook = ''
+  export NIX_LDFLAGS=$(for a in $NIX_LDFLAGS; do echo $a; done |sort|uniq|xargs)
+  export NIX_LDFLAGS_FOR_TARGET=$(for a in $NIX_LDFLAGS_FOR_TARGET; do echo $a; done |sort|uniq|xargs)
+  export NIX_LDFLAGS_FOR_TARGET=$(comm -3 <(for l in $NIX_LDFLAGS_FOR_TARGET; do echo $l; done) <(for l in $NIX_LDFLAGS; do echo $l; done))
+
+
+  # Impurity hack for GHC releases.
+  #################################
+  # We don't want binary releases to depend on nix, thus we'll need to make sure we don't leak in references.
+  # GHC externally depends only on iconv and curses.  However we can't force a specific curses library for
+  # the terminfo package, as such we'll need to make sure we only look in the system path for the curses library
+  # and not pick up the tinfo from the nix provided ncurses package.
+  #
+  # We also need to force us to use the systems COREFOUNDATION, not the one that nix builds. Again this is impure,
+  # but it will allow us to have proper binary distributions.
+  #
+  # do not use nixpkgs provided core foundation
+  export NIX_COREFOUNDATION_RPATH=/System/Library/Frameworks
+  # drop curses from the LDFLAGS, we really want the system ones, not the nix ones.
+  export NIX_LDFLAGS=$(for lib in $NIX_LDFLAGS; do case "$lib" in *curses*);; *) echo -n "$lib ";; esac; done;)
+  export NIX_CFLAGS_COMPILE+=" -Wno-nullability-completeness -Wno-availability -Wno-expansion-to-defined -Wno-builtin-requires-header -Wno-unused-command-line-argument"
+
+  # unconditionally add the MacOSX.sdk and TargetConditional.h
+  export NIX_CFLAGS_COMPILE+=" -isystem /Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/include"
+
+  # Use an architecture specific home, so cabal for different architectures don't confuse each other.
+  export HOME="$HOME/$(uname -m)-home"
+  mkdir -p $HOME
+  '';
+
+  nativeBuildInputs = (with pkgs; [
+    # This needs to come *before* ghc,
+    # otherwise we migth end up with the clang from
+    # the bootstrap GHC in PATH with higher priority.
+    clang_11
+    llvm_11
+
+    haskell.compiler.${compiler}
+    haskell.packages.${compiler}.cabal-install
+    haskell.packages.${compiler}.alex
+    haskell.packages.${compiler}.happy # _1_19_12 is needed for older GHCs.
+
+    automake
+    autoconf
+    m4
+
+    gmp
+    zlib.out
+    zlib.dev
+    glibcLocales
+    # locale doesn't build yet :-/
+    # locale
+
+    git
+
+    python3
+    # python3Full
+    # python3Packages.sphinx
+    perl
+
+    which
+    wget
+    file
+
+    xz
+    xlibs.lndir
+
+    cacert ])
+  ++ (with pkgs.darwin.apple_sdk.frameworks; [ Foundation Security ]);
+}
diff --git a/README.md b/README.md
index 75a56f1..1df8b42 100644
--- a/README.md
+++ b/README.md
@@ -135,6 +135,7 @@ This is the complete list of env variables that change GHCup behavior:
 * `GHCUP_INSTALL_BASE_PREFIX`: the base of ghcup (default: `$HOME`)
 * `GHCUP_CURL_OPTS`: additional options that can be passed to curl
 * `GHCUP_WGET_OPTS`: additional options that can be passed to wget
+* `GHCUP_SKIP_UPDATE_CHECK`: Skip the (possibly annoying) update check when you run a command
 * `CC`/`LD` etc.: full environment is passed to the build system when compiling GHC via GHCup
 
 ### Installing custom bindists
diff --git a/app/ghcup/Main.hs b/app/ghcup/Main.hs
index cc0327a..2da1b12 100644
--- a/app/ghcup/Main.hs
+++ b/app/ghcup/Main.hs
@@ -1144,7 +1144,10 @@ Report bugs at <https://gitlab.haskell.org/haskell/ghcup-hs/issues>|]
 
           case optCommand of
             Upgrade _ _ -> pure ()
-            _ -> runLogger $ flip runReaderT appstate $ checkForUpdates
+            _ -> do
+              lookupEnv "GHCUP_SKIP_UPDATE_CHECK" >>= \case
+                Nothing -> runLogger $ flip runReaderT appstate $ checkForUpdates
+                Just _ -> pure ()
 
 
           -- ensure global tools
diff --git a/ghcup.cabal b/ghcup.cabal
index 92cfaf8..8d3b91d 100644
--- a/ghcup.cabal
+++ b/ghcup.cabal
@@ -157,7 +157,7 @@ library
       , io-streams             >=1.5.2.1
       , terminal-progress-bar  >=0.4.1
 
-  if (flag(tar) || os(windows))
+  if flag(tar)
     cpp-options:   -DTAR
     build-depends: tar
 
@@ -243,7 +243,7 @@ executable ghcup
   if os(windows)
     cpp-options: -DIS_WINDOWS
 
-  if (flag(tar) || os(windows))
+  if flag(tar)
     cpp-options: -DTAR
 
   else
@@ -297,7 +297,7 @@ executable ghcup-gen
     , versions              ^>=4.0.1
     , yaml                  ^>=0.11.4.0
 
-  if (flag(tar) || os(windows))
+  if flag(tar)
     cpp-options:   -DTAR
     build-depends: tar
 
diff --git a/lib/GHCup.hs b/lib/GHCup.hs
index 2c51c6d..372a422 100644
--- a/lib/GHCup.hs
+++ b/lib/GHCup.hs
@@ -1644,7 +1644,9 @@ upgradeGHCup mtarget force = do
   liftIO $ hideError NoSuchThing $ rmFile tempGhcup
 
   lift $ $(logDebug) [i|mv #{destFile} #{tempGhcup}|]
-  liftIO $ Win32.moveFileEx destFile (Just tempGhcup) 0
+  -- NoSuchThing may be raised when we're updating ghcup from
+  -- a non-standard location
+  liftIO $ hideError NoSuchThing $ Win32.moveFileEx destFile (Just tempGhcup) 0
   lift $ $(logDebug) [i|cp #{p} #{destFile}|]
   handleIO (throwE . CopyError . show) $ liftIO $ copyFile p
                                                            destFile